Modern computer service providers rely on data servers and other complex computer systems to provide a variety of essential functions. These systems must be constantly monitored for abnormal behavior that can quickly escalate into major system issues. However, many of these systems are monitored for a large number of various metrics. Detecting abnormalities in such large streams of data can be onerous. Further, once an abnormality is discovered, a system administrator may have very little time to decide how to handle the abnormality.